[openssl-users] SHA1_Update() call leads to segfault

[Alex Lyakas]

Greetings openssl-users,

We had several segmentation faults, all starting from SHA1_Update() call.
See [1], [2] and [3].

Some details:

We are using libcurl to send HTTPS requests to Amazon S3 service. We are
using  "curl_multi" handles to submit and track these HTTPS requests.

The problem happens on a virtual machine running Ubuntu Precise 12.04
distribution, but with a different kernel (mainline 3.8.13). Versions of
relevant user-space packages are below:

ii  libgcrypt11                         1.5.0-3ubuntu0.4                LGPL
Crypto library - runtime library
ii  libgcrypt11-dev                     1.5.0-3ubuntu0.4                LGPL
Crypto library - development files
ii  libhcrypto4-heimdal                 1.6~git20120311.dfsg.1-2
Heimdal Kerberos - crypto library
ii  libk5crypto3                        1.10+dfsg~beta1-2ubuntu0.6      MIT
Kerberos runtime libraries - Crypto Library
ii  libgnutls-openssl27                 2.12.14-5ubuntu3.9              GNU
TLS library - OpenSSL wrapper
ii  libssl-dev                          1.0.1-4ubuntu5.31               SSL
development libraries, header files and documentation
ii  libssl1.0.0                         1.0.1-4ubuntu5.31               SSL
shared libraries
ii  libsslcommon2                       0.14-2
enterprise messaging system - common SSL libraries
ii  openssl                             1.0.1-4ubuntu5.31
Secure Socket Layer (SSL) binary and related cryptographic tools
ii  python-openssl                      0.12-1ubuntu2
Python wrapper around the OpenSSL library

We do not have a reliable reproducer for this issue. It happened once in our
lab, and three more times in the field, all during about 6 months that we
started using libcurl.

Is anybody perhaps familiar with such issue or can give a recommendation of
how to proceed?

Thanks,
Alex.

[1]
#0  0x00007f6b82cb14d0 in ?? () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#1  0xca62c1d6ca62c1d6 in ?? ()
#2  0xca62c1d6ca62c1d6 in ?? ()
#3  0xca62c1d6ca62c1d6 in ?? ()
#4  0xca62c1d6ca62c1d6 in ?? ()
#5  0xca62c1d6ca62c1d6 in ?? ()
#6  0xca62c1d6ca62c1d6 in ?? ()
#7  0xca62c1d6ca62c1d6 in ?? ()
#8  0xca62c1d6ca62c1d6 in ?? ()
#9  0x00007f6b8301c929 in ?? () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#10 0x00007f6b341e8b30 in ?? ()
#11 0x0000000000000016 in ?? ()
#12 0x00007f6b82cad900 in SHA1_Update () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#13 0x00007f6b82d2fe0f in RAND_load_file () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#14 0x00007f6b85488a85 in curl_multi_perform () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#15 0x00000000007248db in __engine_run_requests (eng=0x7f6b54154310) at
common/lib/zobjstore_access.c:1816
#16 0x0000000000722b9b in engine_loop (arg=0x7f6b54154310) at
common/lib/zobjstore_access.c:1534
#17 0x00000000007101b9 in zthread_start_routine (arg=0x7f6b54154330) at
common/lib/zthread.c:118
#18 0x00007f6b85033e9a in start_thread () from
/lib/x86_64-linux-gnu/libpthread.so.0
#19 0x00007f6b8311338d in epoll_wait () from /lib/x86_64-linux-gnu/libc.so.6
#20 0x0000000000000000 in ?? ()

[2]
#0  0x00007f4a322284d0 in ?? () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#1  0xca62c1d6ca62c1d6 in ?? ()
#2  0xca62c1d6ca62c1d6 in ?? ()
#3  0xca62c1d6ca62c1d6 in ?? ()
#4  0xca62c1d6ca62c1d6 in ?? ()
#5  0xca62c1d6ca62c1d6 in ?? ()
#6  0xca62c1d6ca62c1d6 in ?? ()
#7  0xca62c1d6ca62c1d6 in ?? ()
#8  0xca62c1d6ca62c1d6 in ?? ()
#9  0x00007f4a3259392a in ?? () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#10 0x00007f49e50988b0 in ?? ()
#11 0x0000000000000015 in ?? ()
#12 0x00007f4a32224900 in SHA1_Update () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#13 0x00007f4a322a6e0f in ?? () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#14 0x00007f4a31519a05 in ?? () from /lib/x86_64-linux-gnu/libssl.so.1.0.0
#15 0x00007f4a3150f712 in ?? () from /lib/x86_64-linux-gnu/libssl.so.1.0.0
#16 0x00007f4a3150fb04 in ?? () from /lib/x86_64-linux-gnu/libssl.so.1.0.0
#17 0x00007f4a34a1998e in ossl_send () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#18 0x00007f4a349e38c2 in Curl_write () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#19 0x00007f4a349f9a3f in Curl_readwrite () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#20 0x00007f4a34a01ebc in multi_runsingle () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#21 0x00007f4a34a02c55 in curl_multi_perform () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4

[3]
#0  0x00007f4acc7af4d6 in ?? () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#1  0xca62c1d6ca62c1d6 in ?? ()
#2  0xca62c1d6ca62c1d6 in ?? ()
#3  0xca62c1d6ca62c1d6 in ?? ()
#4  0xca62c1d6ca62c1d6 in ?? ()
#5  0xca62c1d6ca62c1d6 in ?? ()
#6  0xca62c1d6ca62c1d6 in ?? ()
#7  0xca62c1d6ca62c1d6 in ?? ()
#8  0xca62c1d6ca62c1d6 in ?? ()
#9  0x00007f4accb1a920 in ?? () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#10 0x00007f4aa00ff5b0 in ?? ()
#11 0x000000000000001f in ?? ()
#12 0x00007f4acc7ab900 in SHA1_Update () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#13 0x00007f4acc82de0f in ?? () from
/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
#14 0x00007f4acbaa0a05 in ?? () from /lib/x86_64-linux-gnu/libssl.so.1.0.0
#15 0x00007f4acba96712 in ?? () from /lib/x86_64-linux-gnu/libssl.so.1.0.0
#16 0x00007f4acba96b04 in ?? () from /lib/x86_64-linux-gnu/libssl.so.1.0.0
#17 0x00007f4acefa098e in ossl_send () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#18 0x00007f4acef6a8c2 in Curl_write () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#19 0x00007f4acef66e69 in Curl_add_buffer_send () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#20 0x00007f4acef68dc9 in Curl_http () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#21 0x00007f4acef7a56b in Curl_do () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#22 0x00007f4acef89501 in multi_runsingle () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4
#23 0x00007f4acef89c55 in curl_multi_perform () from
/usr/lib/x86_64-linux-gnu/libcurl.so.4